LSASS Memory Dump Attempt Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•5

This rule detects attempts to access or dump the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which can contain sensitive credential information. It specifically looks for Security Event ID 4656 (handle to an object was requested) where the target object is 'lsass.exe', 'lsass.bin', or 'ntds.dit', with specific access masks ('0x1fffff' or '0x1410'), and excludes common system accounts. A high count of such access attempts within an hour from a non-system user triggers the alert.